Skip to content

Commit d46d36f

Browse files
author
root
committed
Initial changes
0 parents  commit d46d36f

14 files changed

+293
-0
lines changed

‎.env.sample

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Image
2+
POSTGRESQL_IMAGE=postgres:alpine
3+
REDIS_IMAGE=redis:latest
4+
GITLAB_IMAGE=gitlab/gitlab-ce:latest
5+
6+
# Volumes
7+
configs=./configs
8+
env_files=./env_files
9+
secrets=./secrets
10+
volumes=./volumes
11+
12+
# GitLab External URL
13+
GTILAB_EXTERNAL_URL="https://gitlab.example.com"

‎.gitignore

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
env_files/*.env
2+
secrets/*.txt
3+
volumes/*
4+
5+
!volumes/.gitkeep
6+
7+
.env

‎README.md

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Gitlab docker-compose
2+
3+
Description:
4+
This is supposed to be a gitlab docker-compose stack with the possibility of loadbalancing each component.
5+
You might have to read some gitlab-omnibus docs, in order to undersand how to loadbalance each service.
6+
7+
<!--
8+
## Services
9+
10+
There are mulitple services
11+
-->
12+
13+
## Docs that helped me
14+
15+
INFO: These are CE (Community Edition) docs, meaning they might differ from EE (Enterprise Edition) docs!
16+
17+
* [Architecture](https://docs.gitlab.com/ce/development/architecture.html) <- lot's of links to configurations
18+
* [Architecture with 2k Users](https://docs.gitlab.com/ce/administration/reference_architectures/2k_users.html)
19+
* [Omnibus](https://docs.gitlab.com/omnibus/)
20+
* [Gitaly on it's own server](https://docs.gitlab.com/ce/administration/gitaly/#run-gitaly-on-its-own-server)
21+
* [Load Balancer Ports](https://docs.gitlab.com/ce/administration/load_balancer.html#ports)
22+
* [Nginx Supporting proxied SSL](https://docs.gitlab.com/omnibus/settings/nginx.html#supporting-proxied-ssl)
23+
24+
## Configs
25+
26+
Adjust by preferences, seperated by folders.
27+
28+
## Env Files
29+
30+
INFO: originals will not be pushed, but there are .sample files, rename them
31+
32+
There are env files in multiple locations.
33+
In the root of this project there is a .env file.
34+
At env_files/ there are env files for each service.
35+
36+
## Secrets
37+
38+
INFO: will not be pushed
39+
40+
In the secrets/ folder are all secrets,
41+
there should be following files in there:
42+
43+
* gitlab_root_password.txt
44+
* User: root
45+
* postgres_password.txt
46+
* User: postgres
47+
* redis_password.txt
48+
* User: [X]
49+
50+
## Volumes
51+
52+
INFO: will not be pushed

‎configs/gitaly/gitlab.rb

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Gitaly and GitLab use two shared secrets for authentication, one to authenticate gRPC requests
2+
# to Gitaly, and a second for authentication callbacks from GitLab-Shell to the GitLab internal API.
3+
# The following two values must be the same as their respective values
4+
# of the GitLab Rails application setup
5+
gitaly['auth_token'] = File.read('/run/secrets/gitaly_auth_token')
6+
gitlab_shell['secret_token'] = File.read('/run/secrets/gitlab_shell_secret_token')
7+
8+
# Avoid running unnecessary services on the Gitaly server
9+
postgresql['enable'] = false
10+
redis['enable'] = false
11+
nginx['enable'] = false
12+
puma['enable'] = false
13+
unicorn['enable'] = false
14+
sidekiq['enable'] = false
15+
gitlab_workhorse['enable'] = false
16+
grafana['enable'] = false
17+
18+
# If you run a separate monitoring node you can disable these services
19+
alertmanager['enable'] = false
20+
prometheus['enable'] = false
21+
22+
# Prevent database connections during 'gitlab-ctl reconfigure'
23+
gitlab_rails['rake_cache_clear'] = false
24+
gitlab_rails['auto_migrate'] = false
25+
26+
# Configure the gitlab-shell API callback URL. Without this, `git push` will
27+
# fail. This can be your 'front door' GitLab URL or an internal load
28+
# balancer.
29+
# Don't forget to copy `/etc/gitlab/gitlab-secrets.json` from web server to Gitaly server.
30+
gitlab_rails['internal_api_url'] = 'http://rails'
31+
32+
# Make Gitaly accept connections on all network interfaces. You must use
33+
# firewalls to restrict access to this address/port.
34+
# Comment out following line if you only want to support TLS connections
35+
gitaly['listen_addr'] = "0.0.0.0:8075"
36+
gitaly['prometheus_listen_addr'] = "0.0.0.0:9236"
37+
38+
# Set the network addresses that the exporters used for monitoring will listen on
39+
node_exporter['listen_address'] = '0.0.0.0:9100'
40+
41+
git_data_dirs({
42+
'default' => {
43+
'path' => '/var/opt/gitlab/git-data'
44+
},
45+
'storage1' => {
46+
'path' => '/var/opt/gitlab/git-data1'
47+
},
48+
})

‎configs/rails/gitlab.rb

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
external_url ENV['EXTERNAL_URL']
2+
3+
# Gitaly and GitLab use two shared secrets for authentication, one to authenticate gRPC requests
4+
# to Gitaly, and a second for authentication callbacks from GitLab-Shell to the GitLab internal API.
5+
# The following two values must be the same as their respective values
6+
# of the Gitaly setup
7+
gitlab_rails['gitaly_token'] = File.read('/run/secrets/gitaly_auth_token')
8+
gitlab_rails['initial_root_password'] = File.read('/run/secrets/gitlab_root_password')
9+
gitlab_shell['secret_token'] = File.read('/run/secrets/gitlab_shell_secret_token')
10+
11+
git_data_dirs({
12+
'default' => { 'gitaly_address' => 'tcp://gitaly:8075' },
13+
})
14+
15+
## Disable components that will not be on the GitLab application server
16+
roles ['application_role']
17+
gitaly['enable'] = false
18+
nginx['enable'] = true
19+
letsencrypt['enable'] = false
20+
21+
## PostgreSQL connection details
22+
gitlab_rails['db_adapter'] = 'postgresql'
23+
gitlab_rails['db_encoding'] = 'unicode'
24+
gitlab_rails['db_host'] = 'postgres' # IP/hostname of database server
25+
gitlab_rails['db_password'] = File.read('/run/secrets/postgres_password')
26+
27+
## Redis connection details
28+
gitlab_rails['redis_port'] = '6379'
29+
gitlab_rails['redis_host'] = 'redis' # IP/hostname of Redis server
30+
gitlab_rails['redis_password'] = File.read('/run/secrets/redis_password')
31+
32+
# Set the network addresses that the exporters used for monitoring will listen on
33+
node_exporter['listen_address'] = '0.0.0.0:9100'
34+
gitlab_workhorse['prometheus_listen_addr'] = '0.0.0.0:9229'
35+
sidekiq['listen_address'] = "0.0.0.0"
36+
puma['listen'] = '0.0.0.0'
37+
38+
# Add the monitoring node's IP address to the monitoring whitelist and allow it to
39+
# scrape the NGINX metrics. Replace placeholder `monitoring.gitlab.example.com` with
40+
# the address and/or subnets gathered from the monitoring node
41+
gitlab_rails['monitoring_whitelist'] = ['10.0.1.0/24', '127.0.0.0/8']
42+
nginx['status']['options']['allow'] = ['10.0.1.0/24', '127.0.0.0/8']
43+
44+
## Uncomment and edit the following options if you have set up NFS
45+
##
46+
## Prevent GitLab from starting if NFS data mounts are not available
47+
##
48+
#high_availability['mountpoint'] = '/var/opt/gitlab/git-data'
49+
##
50+
## Ensure UIDs and GIDs match between servers for permissions via NFS
51+
##
52+
#user['uid'] = 9000
53+
#user['gid'] = 9000
54+
#web_server['uid'] = 9001
55+
#web_server['gid'] = 9001
56+
#registry['uid'] = 9002
57+
#registry['gid'] = 9002

‎docker-compose.yml

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
version: "3.3"
2+
3+
services:
4+
# loadbalancer:
5+
# image: ${GITLAB_IMAGE}
6+
7+
postgresql:
8+
image: ${POSTGRESQL_IMAGE}
9+
restart: always
10+
env_file:
11+
- ${env_files}/postgresql.env
12+
secrets:
13+
- postgres_password
14+
# volumes:
15+
# - ${volumes}/postgresql/var/lib/postgresql/data:/var/lib/postgresql/data
16+
# - ${volumes}/postgresql/etc/postgresql/postgresql.conf:/etc/postgresql/postgresql.conf
17+
18+
redis:
19+
image: ${REDIS_IMAGE}
20+
restart: always
21+
command: sh -c redis-server --requirepass $$(cat /run/secrets/redis_password)
22+
secrets:
23+
- redis_password
24+
# volumes:
25+
# - ${volumes}/redis/data:/data
26+
27+
rails:
28+
image: ${GITLAB_IMAGE}
29+
restart: always
30+
env_file:
31+
- ${env_files}/gitlab.env
32+
secrets:
33+
- gitaly_auth_token
34+
- gitlab_root_password
35+
- gitlab_shell_secret_token
36+
- postgres_password
37+
- redis_password
38+
volumes:
39+
- ${configs}/rails/gitlab.rb:/gitlab.rb
40+
#
41+
- ${volumes}/rails/etc/gitlab:/etc/gitlab
42+
- ${volumes}/rails/var/log/gitlab:/var/log/gitlab
43+
- ${volumes}/rails/var/opt/gitlab:/var/opt/gitlab
44+
# ports:
45+
# - 88:80
46+
labels:
47+
- "traefik.enable=true"
48+
49+
# Web Interface
50+
- "traefik.http.routers.http_gitlab.rule=Host(`${GTILAB_EXTERNAL_URL}`)"
51+
- "traefik.http.routers.http_gitlab.entrypoints=web"
52+
- "traefik.http.routers.http_gitlab.middlewares=defaultchain@file,redirectToHttps@file"
53+
54+
- "traefik.http.routers.https_gitlab.rule=Host(`${GTILAB_EXTERNAL_URL}`)"
55+
- "traefik.http.routers.https_gitlab.entrypoints=websecure"
56+
- "traefik.http.routers.https_gitlab.middlewares=defaultchain@file"
57+
- "traefik.http.routers.https_gitlab.service=gitlab"
58+
- "traefik.http.routers.https_gitlab.tls=true"
59+
- "traefik.http.routers.https_gitlab.tls.certresolver=hetzner01"
60+
- "traefik.http.routers.https_gitxlab.tls.domains[0].main=${GTILAB_EXTERNAL_URL}"
61+
62+
- "traefik.http.services.gitlab.loadbalancer.server.port=80"
63+
- "traefik.http.services.gitlab.loadbalancer.server.scheme=http"
64+
- "traefik.http.services.gitlab.loadbalancer.healthcheck.interval=10s"
65+
- "traefik.http.services.gitlab.loadbalancer.healthcheck.port=80"
66+
- "traefik.http.services.gitlab.loadbalancer.healthcheck.scheme=http"
67+
- "traefik.http.services.gitlab.loadbalancer.healthcheck.path=-/-/readiness"
68+
- "traefik.http.services.gitlab.loadbalancer.sticky.cookie=true"
69+
70+
gitaly:
71+
image: ${GITLAB_IMAGE}
72+
restart: always
73+
env_file:
74+
- ${env_files}/gitlab.env
75+
secrets:
76+
- gitaly_auth_token
77+
- gitlab_shell_secret_token
78+
volumes:
79+
- ${configs}/gitaly/gitlab.rb:/gitlab.rb
80+
#
81+
- ${volumes}/gitaly/etc/gitlab:/etc/gitlab
82+
- ${volumes}/gitaly/var/log/gitlab:/var/log/gitlab
83+
- ${volumes}/gitaly/var/opt/gitlab:/var/opt/gitlab
84+
85+
secrets:
86+
gitaly_auth_token:
87+
file: ${secrets}/gitaly_auth_token.txt
88+
gitlab_root_password:
89+
file: ${secrets}/gitlab_root_password.txt
90+
gitlab_shell_secret_token:
91+
file: ${secrets}/gitlab_shell_secret_token.txt
92+
postgres_password:
93+
file: ${secrets}/postgres_password.txt
94+
redis_password:
95+
file: ${secrets}/redis_password.txt
96+
97+
networks:
98+
default:
99+
driver: bridge
100+
ipam:
101+
driver: default
102+
config:
103+
- subnet: 10.0.1.0/24

‎env_files/gitlab.env.sample

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
GITLAB_OMNIBUS_CONFIG="from_file('/gitlab.rb')"
2+
3+
EXTERNAL_URL=${GTILAB_EXTERNAL_URL}

‎env_files/postgresql.env.sample

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password
2+
3+
# DO NOT CHANGE THOSE
4+
POSTGRES_USER=gitlab
5+
POSTGRES_DB=gitlabhq_production

‎secrets/gitaly_auth_token.txt.sample

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
yourSecretKey

‎secrets/gitlab_root_password.txt.sample

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
yourSecretKey

0 commit comments

Comments
 (0)